Beyond the News
Sign in
Artificial IntelligenceWeb DevelopmentAI CodingDeveloper Tools Active dossier

GitHub AI Scan no longer needs CodeQL default setup

GitHub has removed a setup dependency from its AI-powered pull-request security scanning: repositories can now use AI Scan without first enabling CodeQL default setup, widening the feature beyond repositories already configured around CodeQL’s standard analysis pipeline.

Reviewed and published by Lars Jansen Updated 4 min read
Comment
First published

Key details

  1. GitHub announced the prerequisite change on September 16, 2026.
  2. AI Scan no longer requires CodeQL default setup.
  3. GitHub’s July 14 rollout of AI-powered security detections had required GitHub Code Security and CodeQL default setup.
  4. The change lowers configuration coupling rather than introducing a new scanning model.
  5. Existing GitHub repository security controls such as secret scanning and rulesets remain separate mechanisms.

What builders should take away

  1. If you skipped AI Scan because your repository does not use CodeQL default setup, re-evaluate the feature against your current code-scanning configuration.
  2. Do not switch from a carefully tuned advanced CodeQL configuration merely to obtain AI Scan; the new rollout removes that reason.
  3. Measure AI Scan findings separately from deterministic CodeQL findings so you can evaluate false-positive and incremental-detection value.
  4. Keep merge policy explicit: enabling an AI scanner does not automatically mean every AI finding should become a hard merge blocker.

What changed

GitHub announced on September 16, 2026 that AI Scan no longer requires CodeQL default setup. When GitHub introduced AI-powered security detections on pull requests in July, the feature required GitHub Code Security and CodeQL default setup. The new rollout removes that specific CodeQL configuration dependency, allowing eligible repositories to enable the AI scanning path without first adopting default setup.

Why it matters

Security features often fail to spread because the prerequisite architecture is more invasive than the feature itself. Removing CodeQL default setup as a hard dependency lowers the integration cost for repositories that use advanced CodeQL configuration, another scanning workflow or simply have not adopted default setup. It also separates GitHub’s AI-assisted vulnerability detection more clearly from one particular static-analysis configuration, although eligibility, licensing and the AI scanner’s own detection quality remain separate questions.

The July rollout had a concrete CodeQL prerequisite

GitHub’s original AI security detections on pull requests were tied to GitHub Code Security with CodeQL default setup enabled. That meant the AI layer was not simply an independent switch for every repository already using GitHub.

September removes the default-setup dependency

GitHub now says AI Scan can operate without CodeQL default setup. Repositories that deliberately use a different CodeQL configuration path no longer need to restructure that setup merely to access the AI scan.

This changes adoption more than scanner capability

The material change is packaging and integration. GitHub is not claiming a new model or a new vulnerability class in this announcement; it is removing a prerequisite that constrained where the existing AI-powered scan could be used.

AI Scan still belongs in a layered security workflow

An AI scanner can surface additional findings, but it does not replace deterministic analysis, secret scanning, dependency review or human security review. Teams should compare false positives, missed issues and remediation usefulness against their existing pipeline before making it a required merge gate.

What to watch next

  • Whether GitHub broadens AI Scan eligibility or licensing beyond the current Code Security boundary.
  • Independent measurements of incremental vulnerability detection versus CodeQL alone.
  • Whether AI Scan gains organization/enterprise policy and API controls for fleet-wide rollout.
  • Whether GitHub exposes clearer provenance explaining which findings came from AI Scan versus deterministic queries.
  • Any move from optional pull-request findings toward enforceable ruleset integration.

Still unclear

  • GitHub’s September announcement is primarily a setup/availability change and does not provide new independent accuracy data for AI Scan.
  • Removing CodeQL default setup does not mean all repositories or plans necessarily receive the feature.
  • The operational value depends on how much AI Scan adds beyond a team’s existing static-analysis and review workflow.

Sources

Direct reading behind this dossier.

2 sources

Discussion

Discussion is reader-contributed. Comments are not part of the BTN dossier or its editorial evidence.

0 visible comments

Join the discussion

Keep comments useful and relevant. Reader contributions may be moderated and are not BTN editorial evidence.

Sign in to comment
Continue reading
Artificial Intelligence

GitHub Copilot is moving enterprise seats to upfront billing and longer chat retention

From September and October, Copilot Business and Enterprise seat access becomes more tightly coupled to upfront payment. A separate September 28 policy migration enables a unified Copilot experience by default, retains github.com chat data for the life of the account and changes code review’s default effort from Lite to Balanced.